The CSP that killed our own form (a production-only Next.js bug)

A user wrote to us with the kind of bug report that makes your stomach drop: "The forgot-password...